# PhishDestroy domain threat record: ethamg26-fr.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/ethamg26-fr.com/ Machine-readable companion: https://phishdestroy.io/domain/ethamg26-fr.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-22 13:11:42 UTC - Last availability or vendor check: 2026-10-22 13:11:42 UTC - Stored record updated: 2026-10-22 16:30:29 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ethereum ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: Hosting Concepts B.V. d/b/a Registrar.eu - Registrar country in stored WHOIS data: GB - Last stored HTTP status: 200 - Registration date (registry RDAP, ethamg26-fr.com): 2026-10-20 18:32:22 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a163bc-3f5a-75c9-af76-077375a1b09d/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/ethamg26-fr.com - Certificate Transparency search: https://crt.sh/?q=%25.ethamg26-fr.com - Web Archive lookup: https://web.archive.org/web/*/https://ethamg26-fr.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed ethamg26-fr.com as malicious after an admin report noted a newly‑registered site that advertises an AI‑assisted crypto trading platform and requests an initial deposit. The recorded page title "EthAMG 2.6 – Analyse assistée par IA pour les marchés crypto et actions" and a deposit‑field excerpt were observed on 2026-10-22. An HTTP 200 response was recorded on that date, confirming the page was reachable at the time. How the scam works Fraudulent investment schemes typically claim advanced or AI‑driven analysis to lure users into sending money, promising high returns without delivering a real service. Victims are asked to deposit funds and are later left without access to the promised tools or returns. Evidence VirusTotal scanned the domain on 2026-10-22, reporting one suspicious detection (SOCRadar) out of 92 engines and tagging it as "dga". Google Safe Browsing checked on the same day and did not flag the URL. External blocklists MetaMask and SEAL listed the domain, and OTX recorded four pulses referencing it. urlscan.io captured the site on 2026-10-22; its engine verdict marked it malicious with a score of 96, while the overall verdict was neutral. Infrastructure The domain was registered on 2026-10-20 through Hosting Concepts B.V. d/b/a Registrar.eu, giving it an age of one day at first sight. The recorded IP was 188.114.97.3, which belonged to Cloudflare’s network in Great Britain. The TLS certificate issued by Let’s Encrypt was valid from 2026-10-20 to 2027-01-18, and DNSSEC was not observed. What to do Users should avoid submitting any deposits or personal credentials to the site; if credentials were entered, change the associated passwords immediately. Organizations should block the exact domain ethamg26-fr.com and monitor outbound connections to its recorded IP address, adding it to internal blocklists. Review access logs for any activity on or after 2026-10-22 and treat any credential exposure as a potential compromise. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a163bc-3f5a-75c9-af76-077375a1b09d/ Cloudflare Radar report: https://radar.cloudflare.com/scan/547dea7a-8eb5-4127-801b-f6fc30fc834f URLQuery report: https://urlquery.net/report/62c627f3-463a-4413-9535-93f2f762d243 Stored capture screenshot: https://i.ibb.co/GYSzhK1/c8dbfd49a0e3.png Cloudflare Radar screenshot (2026-10-22T13:48:45Z): https://screenshots.phishdestroy.io/cf/547dea7a-8eb5-4127-801b-f6fc30fc834f.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/62c627f3-463a-4413-9535-93f2f762d243.png URLScan screenshot (2026-10-22T13:24:34Z): https://screenshots.phishdestroy.io/us/01a163c8-d5fa-7559-8ee4-5d9796bbb9b0.png URLScan capture report: https://urlscan.io/result/01a163c8-d5fa-7559-8ee4-5d9796bbb9b0/ VirusTotal report: https://www.virustotal.com/gui/domain/ethamg26-fr.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ethamg26-fr.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-22 14:23:51 UTC ## Stored page captures - Primary capture: https://i.ibb.co/GYSzhK1/c8dbfd49a0e3.png Captured: 2026-10-22 13:11:42 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a163bc-3f5a-75c9-af76-077375a1b09d.png Captured: 2026-10-22 13:11:42 UTC Source report: https://urlscan.io/result/01a163bc-3f5a-75c9-af76-077375a1b09d/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/547dea7a-8eb5-4127-801b-f6fc30fc834f.png Captured: 2026-10-22 13:48:45 UTC Source report: https://radar.cloudflare.com/scan/547dea7a-8eb5-4127-801b-f6fc30fc834f SHA-256: bb247e08cf16133fadc0f60f3b90ca1e2e346f0e06acd026db600124fc1c2c17 - URLQuery: https://screenshots.phishdestroy.io/uq/62c627f3-463a-4413-9535-93f2f762d243.png Source report: https://urlquery.net/report/62c627f3-463a-4413-9535-93f2f762d243 SHA-256: d241748aa14721fc9a8042e70d8563a42ce9a04d07231385c6991be38116e619 - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163c8-d5fa-7559-8ee4-5d9796bbb9b0.png Captured: 2026-10-22 13:24:34 UTC Source report: https://urlscan.io/result/01a163c8-d5fa-7559-8ee4-5d9796bbb9b0/ SHA-256: de7cd3c9fb548ed236702ec5bded9e394983b3957ad71fbb96b4d262f7c7187f ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T13:51:08Z", "uuid": "01a163bc-3f5a-75c9-af76-077375a1b09d", "scanned_at": "2026-10-22T13:10:50Z", "final_url": "https://ethamg26-fr.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://ethamg26-fr.com/", "from": "http://ethamg26-fr.com/", "status": 307 } ], "ip": "188.114.97.3", "domains": [ "cdn.jsdelivr.net", "region1.google-analytics.com", "www.googletagmanager.com" ], "ips": [ "2606:4700::6811:d005", "2001:4860:4802:32::36", "2a00:1450:4001:c0f::61", "188.114.97.3" ], "asns": [ "13335", "15169" ], "countries": [ "US", "DE" ], "doc_hash": "0a69b187683b1fc8e885414f657a9b8b3a1809e08a4086a4c15bd6acadcabea7", "script_hashes": [ "6489e9e41e19b9b7693c57212863f0b3fcd805056339e7cc85b169d1aeff1e86", "df2fca8c5e5a0a3455ceb3530594a8ff13548a5ced799d73c234012f05b3bf11", "8bc146b03f6083f6f19f33e314bc52270887407cca4345b09909af5952e83f11", "06f965a8bffba0d054c5f78abedb30db7b5455fe6e46967680a6c7a0171c3a1f", "710ab8e8b52be5f2338f028f9e60c41b7228905970305f20a55b9edb3776307b", "584c17b9f6bd2233d5cd69fb1e2b53339ed16e820dfe16bc957bd64ced812271", "827de3e56f86d46f3624f5ade3700be6217b8fd710a0158b737806bf25c814d1" ], "globals": [ "tns", "gtag", "dataLayer", "loadCidValue", "getLanguageByGeo", "getCountryByIP", "isOnlyCountries", "showError", "reset", "sendGa4Event", "setupFormValidation", "intlTelInput", "google_tag_data", "google_tag_manager", "gaGlobal", "forms", "validationI18n", "errorMap", "requiredMessage", "unsupportedCountryMessage", "invalidFallback", "languagesByCountry" ], "cookies": [ "PHPSESSID", "_ga_5BPJFD6YGN", "_ga" ], "tls": { "san": [ "*.ethamg26-fr.com", "ethamg26-fr.com" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "ethamg26-fr.com", "protocol": "QUIC", "valid_to": "2027-01-18T17:39:55Z", "valid_from": "2026-10-20T17:39:56Z" }, "domain_age_days": 1, "apex_age_days": 1, "tls_age_days": 1, "tls_valid_days": 89, "requests": 44, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 96, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31536000; includeSubDomains; preload", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T13:51:10Z", "uuid": "547dea7a-8eb5-4127-801b-f6fc30fc834f", "scanned_at": "2026-10-22T13:48:45Z", "final_url": "https://ethamg26-fr.com/", "status": 200, "history": [ { "url": "https://ethamg26-fr.com/", "status": 200 } ], "dom_hash": "4a548e54b3a08ca8fb87fdc94aff9a6efed928e18630039e6f8aef8f2c2ce7ad", "doc_hash": "7a69d96930c7579e7d0487f76001e46320d501be6ee66698fa72928f21727f74", "phishing_v2": [ "phishing" ], "url_risks": [ "Scam" ], "domain_risks": [ "Newly Seen Domains", "Security Risks", "Scam", "Security threats", "New Domains", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "ethamg26-fr.com", "type": "A", "value": "188.114.96.0" }, { "name": "ethamg26-fr.com", "type": "A", "value": "188.114.97.0" }, { "name": "ethamg26-fr.com", "type": "AAAA", "value": "2a06:98c1:3121::" }, { "name": "ethamg26-fr.com", "type": "AAAA", "value": "2a06:98c1:3120::" } ], "dnssec_valid": false, "ip": "188.114.96.0", "whois": { "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu", "created": "2026-10-20T18:32:22Z", "updated": "2026-10-20T18:36:35Z", "expires": "2027-10-20T18:32:22Z", "nameservers": [ "jose.ns.cloudflare.com", "naya.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T14:22:11Z", "analysis_at": "2026-10-22T13:25:16Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 1, "undetected": 36 }, "detections": { "SOCRadar": "suspicious" }, "reputation": 0, "tags": [ "dga" ], "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu", "created": "2026-10-20T18:32:22Z", "expires": "2027-10-20T18:32:22Z", "updated": "2026-10-20T20:36:37Z", "first_seen": "2026-10-20T20:18:57Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "jose.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::6815:20e5" }, { "ttl": 21600, "type": "NS", "value": "naya.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.32.229" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::ac43:9c53" }, { "ttl": 21600, "type": "NS", "value": "jose.ns.cloudflare.com" }, { "ttl": 3600, "type": "TXT", "value": "google-site-verification=fOO1ykD9fJj8G1y4-hmGV6LEIg_s73rVRHIPKRnwUWQ" }, { "ttl": 300, "type": "A", "value": "172.67.156.83" } ], "dns_at": "2026-10-22T13:30:38Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.ethamg26-fr.com", "ethamg26-fr.com" ], "issuer": "Let's Encrypt / YE1", "serial": "6adcffc90d682b6515c0d3e21f614410732", "sha256": "715053be0ac486080734bdf9a7698d8d50d83e866f63efd5b112b253b87bce6d", "subject": "ethamg26-fr.com", "valid_to": "2027-01-18T17:39:55Z", "valid_from": "2026-10-20T17:39:56Z" }, "whois": { "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu", "registrar_iana_id": "1647", "registrar_url": "http://www.openprovider.com", "created": "2026-10-20T18:32:22Z", "updated": "2026-10-20T18:36:35Z", "expires": "2027-10-20T18:32:22Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "jose.ns.cloudflare.com", "naya.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-10-20T18:32:22Z", "registration": "2026-10-20T18:32:22Z", "registrar expiration": "2027-10-20T18:32:22Z", "last update of RDAP database": "2026-10-20T20:18:56Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-22T13:51:25Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "ethamg26-fr.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-22T13:17:37Z", "first": "2026-10-22T13:17:37Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 8956 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://ethamg26-fr.com/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 10 }, "social_tags": { "title": "EthAMG 2.6 – Analyse assistée par IA pour les marchés crypto et actions", "author": "EthAMG 2.6", "robots": "index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1", "description": "EthAMG 2.6 propose une analyse de marché assistée par IA pour les cryptomonnaies et les actions. Découvrez des données, des tendances et des outils pour des décisions de trading structurées", "canonicalUrl": "https://ethamg26-fr.com/" }, "trackers": { "requests": 35, "trackers": [ { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 1 }, { "name": "Google Analytics", "company": "Google", "country": "US", "category": "Site Analytics", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://www.googletagmanager.com/gtag/js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 5, "tls": 27, "wait": 86, "connect": 7, "download": 1 }, "response_ms": 126 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 33825, "co2_grams": 0.0012, "cleaner_than": 45 }, "dns_server": { "ns": [ { "ip": "162.159.44.88", "host": "jose.ns.cloudflare.com" }, { "ip": "162.159.38.242", "host": "naya.ns.cloudflare.com" } ], "zone": "ethamg26-fr.com" }, "cookies": { "cookies": [ { "name": "PHPSESSID", "session": true }, { "name": "_ga_5BPJFD6YGN" }, { "name": "_ga" } ] }, "location": { "ip": "2a06:98c1:3121::9", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "ethamg26-fr.com" }, "dns": { "A": [ "188.114.96.9", "188.114.97.9" ], "NS": [ "jose.ns.cloudflare.com", "naya.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"jose.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418034747, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "google-site-verification=fOO1ykD9fJj8G1y4-hmGV6LEIg_s73rVRHIPKRnwUWQ" ], "AAAA": [ "2a06:98c1:3120::9", "2a06:98c1:3121::9" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=31536000; includeSubDomains; preload", "message": "Site is compatible with the HSTS preload list!", "compatible": true }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": "1; mode=block", "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=31536000; includeSubDomains; preload", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3120::9", "family": 6 }, "redirects": { "chain": [ "https://ethamg26-fr.com" ] }, "tech_stack": { "technologies": [ "Google Analytics", "Priority Hints", "HSTS", "Cloudflare", "HTTP/3" ] }, "linked_pages": { "internal_count": 11 }, "whois": { "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu", "created": "2026-10-20T18:32:22Z", "updated": "2026-10-20T18:36:35Z", "expires": "2027-10-20T18:32:22Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "jose.ns.cloudflare.com", "naya.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31536000; includeSubDomains; preload", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } } } } ```